Skills form-testing

📦

form-testing

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Test WordPress Forms and Email Delivery

WordPress teams need proof that forms submit correctly and messages reach inboxes. This skill provides WP-CLI and curl checks for email delivery, SMTP settings, and form behavior.

Supports: Claude Codex Code(CC)

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "form-testing" from https://skillstore.io/skills/crazyswami-form-testing.md and its manifest at https://skillstore.io/api/skills/crazyswami-form-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/crazyswami-form-testing.md Signed manifest GET /api/skills/crazyswami-form-testing/manifest Signed lockfile GET /api/skills/crazyswami-form-testing/lockfile

Test it

Using "form-testing". Check email delivery in the wordpress container for ops@example.com.

Expected outcome:

Result: SMTP plugin active. Test message sent to the approved recipient. No PHPMailer error was reported.

Using "form-testing". Review the contact page form before launch.

Expected outcome:

Report: required fields validated, redirect confirmed, admin email received, and nonce protection should be reviewed.

Using "form-testing". Troubleshoot missing form emails after migration.

Expected outcome:

Findings: SMTP settings are incomplete. Configure an approved mailer, send a new test message, and verify DNS records.

Security Audit

High Risk

v8 • 7/6/2026 Open versioned report

Most SKILL.md backtick and URL findings are documentation false positives, and no prompt injection was found. The skill still has real shell, WP-CLI, SMTP inspection, and outbound email capabilities. High-risk issues remain in scripts/test-mail.sh because the recipient is unescaped in wp eval and defaults to an external email address.

2

Files scanned

395

Lines analyzed

40

Review items

0

False positives ignored

Confirmed security concerns (4)

High

scripts/test-mail.sh:8 scripts/test-mail.sh:50-51

Unescaped Recipient In WP-CLI Eval

scripts/test-mail.sh inserts the recipient argument directly into PHP code passed to wp eval. A crafted value containing a quote can break out of the string and run PHP inside the WordPress container.

The script assigns TO_EMAIL from user input and interpolates it into a quoted PHP string inside wp eval without escaping. This is a direct code injection pattern.

High

scripts/test-mail.sh:8 scripts/test-mail.sh:50-64

Hard-Coded External Test Recipient

The test email recipient defaults to admin@csrdevelopment.com. If the script runs without an explicit recipient, it sends site URL, PHP version, and WordPress version to that external address.

The default recipient is hard-coded, and the message body clearly includes site and version details before calling wp_mail. This is strong evidence of unintended outbound disclosure.

Medium

System reconnaissance

docker exec wordpress wp db query "SELECT * FROM wp_wpmailsmtp_logs ORDER BY id DESC LIMIT 5"

The command queries WP Mail SMTP logs from the WordPress database. This is not host reconnaissance, but it can expose sensitive application email metadata.

Medium

SKILL.md:226-240

SMTP Credentials In Command-Line Example

SKILL.md shows SMTP username and password fields inside a wp option update command. Users who paste real values can expose secrets through shell history, process listings, or shared logs.

The credentials are placeholders, not leaked real secrets. The risk is still credible because the documented command pattern encourages placing live secrets on the command line.

Capability review items (40)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/test-mail.sh:1

Unix shell invocation

#!/bin/bash

scripts/test-mail.sh is an executable Bash script that runs docker exec and wp eval. This is legitimate testing behavior, but it gives the skill external command capability.

Medium

scripts/test-mail.sh:18

Email sending capability

# Check if WP Mail SMTP is active

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:19

Email sending capability

echo "Checking WP Mail SMTP plugin..."

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:20

Email sending capability

if docker exec "$CONTAINER" wp plugin is-active wp-mail-smtp 2>/dev/null; then

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:21

Email sending capability

echo -e " \033[0;32m✓\033[0m WP Mail SMTP is active"

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:23

Email sending capability

echo -e " \033[0;33m⚠\033[0m WP Mail SMTP not active (using PHP mail)"

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:26

Email sending capability

# Get SMTP configuration

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:28

Email sending capability

echo "SMTP Configuration:"

This line is part of the mail test script that checks WP Mail SMTP and later sends a real wp_mail message. The capability is intended, but it is an outbound email risk.

Medium

scripts/test-mail.sh:30

Email sending capability

$options = get_option("wp_mail_smtp");

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

scripts/test-mail.sh:32

Email sending capability

if (!empty($options["smtp"]["host"])) {

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

scripts/test-mail.sh:33

Email sending capability

echo " Host: " . $options["smtp"]["host"] . "\n";

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

scripts/test-mail.sh:34

Email sending capability

echo " Port: " . $options["smtp"]["port"] . "\n";

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

scripts/test-mail.sh:35

Email sending capability

echo " Encryption: " . ($options["smtp"]["encryption"] ?: "none") . "\n";

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

scripts/test-mail.sh:36

Email sending capability

echo " Auth: " . ($options["smtp"]["auth"] ? "Yes" : "No") . "\n";

The script reads and prints WP Mail SMTP configuration from the target container. This exposes mail infrastructure details and supports a later real email send.

Medium

Unix shell invocation

#!/bin/bash

SKILL.md embeds a Bash version of the test-mail script. It documents Docker and WP-CLI command execution, which is expected but still powerful.

Medium

Email sending capability

description: Test WordPress form submissions and email delivery. Validates contact forms, checks WP

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

Comprehensive form testing for WordPress sites - validates form submissions, email delivery, and SMT

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

# Test WP Mail SMTP configuration

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

- WP Mail SMTP plugin configuration

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

- SMTP server connectivity

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

### Method 2: Check SMTP Configuration

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

# Check WP Mail SMTP options

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

docker exec wordpress-container wp option get wp_mail_smtp --format=json | jq

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

# Check if SMTP is configured

This line documents the skill intent to perform SMTP checks or email delivery tests. The capability is legitimate, but it is real outbound mail functionality.

Medium

Email sending capability

$options = get_option("wp_mail_smtp");

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

if (!empty($options["smtp"]["host"])) {

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

echo "SMTP Host: " . $options["smtp"]["host"] . "\n";

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

echo "SMTP Port: " . $options["smtp"]["port"] . "\n";

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

echo "SMTP Auth: " . ($options["smtp"]["auth"] ? "Yes" : "No") . "\n";

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

echo "Encryption: " . $options["smtp"]["encryption"] . "\n";

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

echo "SMTP not configured - using PHP mail()\n";

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

docker exec wordpress wp option get wp_mail_smtp --format=json

The documented WP-CLI commands inspect WP Mail SMTP settings and can reveal mail infrastructure configuration. This is legitimate troubleshooting but sensitive.

Medium

Email sending capability

docker exec wordpress wp db query "SELECT * FROM wp_wpmailsmtp_logs ORDER BY id DESC LIMIT 5"

The documented database query reads recent WP Mail SMTP log records. Those logs can contain recipient and delivery metadata.

Medium

Email sending capability

# Set up SMTP configuration

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

docker exec wordpress wp option update wp_mail_smtp '{

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

"mailer": "smtp"

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

"smtp": {

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

"host": "smtp.example.com",

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

"user": "smtp-user",

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Medium

Email sending capability

"pass": "smtp-password"

The documented WP-CLI command changes SMTP configuration and includes credential fields. This can affect outbound mail routing and expose secrets if copied directly.

Risk Factors

⚙️ External commands (37)

🌐 Network access (55)

scripts/test-mail.sh:18 scripts/test-mail.sh:19 scripts/test-mail.sh:20 scripts/test-mail.sh:21 scripts/test-mail.sh:23 scripts/test-mail.sh:26 scripts/test-mail.sh:28 scripts/test-mail.sh:30 scripts/test-mail.sh:32 scripts/test-mail.sh:33 scripts/test-mail.sh:34 scripts/test-mail.sh:35 scripts/test-mail.sh:36 SKILL.md:18 SKILL.md:99 SKILL.md:190 SKILL.md:310 SKILL.md:311 SKILL.md:312 SKILL.md:3 SKILL.md:9 SKILL.md:14 SKILL.md:29 SKILL.md:31 SKILL.md:75 SKILL.md:78 SKILL.md:79 SKILL.md:81 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:90 SKILL.md:158 SKILL.md:160 SKILL.md:163 SKILL.md:165 SKILL.md:177 SKILL.md:179 SKILL.md:205 SKILL.md:212 SKILL.md:216 SKILL.md:220 SKILL.md:225 SKILL.md:226 SKILL.md:230 SKILL.md:232 SKILL.md:233 SKILL.md:237 SKILL.md:238 SKILL.md:273 SKILL.md:274 SKILL.md:310

📁 Filesystem access (6)

scripts/test-mail.sh:20 scripts/test-mail.sh:45 SKILL.md:15 SKILL.md:18 SKILL.md:21 SKILL.md:192

Detected Patterns

System reconnaissance

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Security Assessment

Copy report link

https://skillstore.io/skills/crazyswami-form-testing/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-form-testing/security.svg)](https://skillstore.io/skills/crazyswami-form-testing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/crazyswami-form-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-form-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/crazyswami-form-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

CrazySwami. (2026). form-testing security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-form-testing/audits/8

BibTeX citation

@techreport{crazyswami-crazyswami-form-testing-2026,
  author = {CrazySwami},
  title = {form-testing security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/crazyswami-form-testing/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "form-testing security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "CrazySwami"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/crazyswami-form-testing/audits/8"
identifiers:
  - type: other
    value: "skillstore:crazyswami-form-testing:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

45

Architecture

85

Maintainability

85

Content

70

Community

83

Spec Compliance

What You Can Build

Verify Site Email Delivery

Check SMTP plugin status and send a controlled test message after a migration or launch.

Test Contact Form Behavior

Submit a known form payload and confirm redirects, validation, and admin email receipt.

Audit Form Security Basics

Review nonce usage, input sanitization, reply-to handling, and email header safety.

Try These Prompts

Check Email Setup

Check the WP Mail SMTP status for my WordPress container named [container]. Do not send email yet.

Send Test Message

Send one WordPress test email from [container] to [approved address]. Summarize the result and any mailer error.

Verify Contact Form

Test the contact form at [authorized URL] with safe sample data. Report validation, redirects, and delivery checks.

Run Full Form Audit

Audit forms on [authorized site]. Check SMTP, test delivery, verify nonce behavior, and produce prioritized remediation steps.

Best Practices

Run tests only on sites and containers you are authorized to access.
Use an explicit approved recipient for every email test.
Redact SMTP details before sharing reports or tickets.

Avoid

Do not test forms on third-party sites without permission.
Do not rely on default recipient addresses for delivery tests.
Do not paste real SMTP passwords into prompts or public issue trackers.

Frequently Asked Questions

Does this skill send real email?

Yes. The test script can send a real WordPress email to the chosen recipient.

What access is required?

You need shell access, Docker access, and WP-CLI access to the WordPress container.

Can it test any contact form plugin?

It gives general curl and audit steps, but some examples use CSR theme field names.

Does it verify inbox receipt automatically?

No. It sends test messages and reports WordPress errors. A human still checks the inbox.

Is it safe for production?

Use it carefully with approved recipients. Prefer staging when testing form behavior.

Does it store SMTP credentials?

The examples show WordPress SMTP configuration. Real credentials should be handled outside prompts and logs.

Developer Details

Author

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/CrazySwami/wordpress-dev-skills/tree/main/skills/form-testing

Ref

d11af420e07cd866fe39cfa937efef3223896c06

Maintenance freshness

7/18/2026

Usage

5 downloads · 167 views

File structure

📄 test-mail.sh

More from CrazySwami

testing

Build Reliable TypeScript Tests

Testing React applications can be slow when selectors and patterns are inconsistent. This skill guides Playwright, Vitest, and Storybook tests using stable project evidence.

Coding & Development View

code-quality

Improve TypeScript Code Quality

TypeScript and React teams need consistent quality checks before changes ship. This skill gives Claude, Codex, and Claude Code focused review standards and repair guidance.

Coding & Development View

wp-test-analyzer

Analyze WordPress Test Targets

WordPress theme testing often misses forms, templates, navigation, and dynamic content. This skill extracts practical test targets for E2E planning.

Coding & Development View

gsap-animations

Build accessible GSAP animations

Modern web animations can hurt performance and accessibility when they are implemented without clear guardrails. This skill gives Claude practical GSAP patterns, testing steps, and launch checks for polished animation work.

Design & Creative View

wp-orchestrator

Coordinate WordPress Site Builds and Audits

WordPress projects require setup, audits, SEO, testing, and handoff across several tools. This skill coordinates those phases and calls related WordPress skills.

DevOps & Infrastructure View

brand-guide

Create Brand Style Guides for Websites

Teams often lack a clear record of brand colors, type, imagery, and responsive rules. This skill turns site assets and brand inputs into structured guide content for Claude, Codex, and Claude Code workflows.

Design & Creative View

wp-wpcli-and-ops

Manage WordPress Safely with WP-CLI

by Automattic

WordPress command-line operations can damage data or affect the wrong site. This skill provides guarded workflows for inspection, changes, automation, and verification.

DevOps & Infrastructure View

wp-performance

Diagnose WordPress Performance Safely

by Automattic

Slow WordPress sites need careful measurement before changes. This skill guides Claude, Codex, and Claude Code through backend-only profiling, bottleneck analysis, and safe verification.

DevOps & Infrastructure View

wp-migrate

Migrate WordPress Sites with wp-migrate.sh

by BWBama85

WordPress migrations can damage data, paths, or URLs when steps are missed. This skill guides preview, backup, migration, rollback, and troubleshooting workflows with wp-migrate.sh.

DevOps & Infrastructure View

wp-plugin-development

Build Secure WordPress Plugins

by Automattic

WordPress plugin changes can introduce lifecycle, data, and security defects. This skill provides a structured workflow for implementation, review, testing, and release preparation.

Coding & Development View

wp-block-themes

Build WordPress Block Themes

by Automattic

Block theme changes often fail because settings, templates, and editor overrides interact. This skill guides theme.json, templates, patterns, style variations, and troubleshooting.

Coding & Development View

wp-block-development

Build and Maintain WordPress Blocks

by Automattic

WordPress block changes can break registration, saved content, or editor behavior. This skill guides implementation, migration, debugging, and verification for Gutenberg blocks.

Coding & Development View